Morioh High

Privacy Policy

Updated 2026-10-18. Public sources checked 2026-10-18.

Who this covers

This policy describes the repository implementation reviewed on 18 October 2026. The site contact is [email protected]. It does not provide a visitor account, comment system or public correction form. Emailing the address discloses your email address and the content you choose to send to the mail services and recipient involved.

Cloudflare Email Routing is enabled and ready, with an active forwarding rule and no reported DNS problems as of 18 October 2026. Mail to the site contact is routed to the operator’s inbox; domain MX, SPF and DKIM records are configured. Hosting, mail delivery, an external video player and an advertising network have separate data handling; this page does not claim that any provider stores no data.

What loads before you choose

Google Analytics 4 (gtag.js, loaded from www.googletagmanager.com under measurement ID G-FFHXV3E0RP) is the only third-party script in the initial page. Google consent mode defaults queue ad_storage, ad_user_data, ad_personalization and analytics_storage as denied before the tag is configured, and ads_data_redaction is switched on. No advertising, session-recording or video player script is present in the HTML at all: those loaders are created by JavaScript only after an Accept click, so a reject leaves the page with no such request.

Nothing chooses for you. Without a fresh stored choice the site shows its consent panel; the default state, on a first visit and after a reject, is no analytics cookies, no recordings and no ad requests.

The video and advertising controller treats navigator.globalPrivacyControl === true or navigator.doNotTrack === "1" as a refusal. Those signals pin the choice to denied, so the panel cannot grant anything, including after an Accept click.

What loads after you accept

Accepting sends the same consent update for all four consent-mode signals and then injects three services. Reopening Cookie settings and choosing Reject removes the injected advertising scripts and empties the ad slot on the current page, and the stored decision keeps them off on later visits. Clarity is the one exception: once its library has been fetched in a page, it cannot be unloaded from that page, so rejecting stops it from being fetched again but cannot erase what it already collected there.

Microsoft Clarity (project yzj4kbhlzv) records sessions and heatmaps. Its loader is fetched from www.clarity.ms, the library is served by scripts.clarity.ms, and downstream collection uses *.clarity.ms.

Adsterra serves this site’s only advertising inventory: a Native Banner (ad unit NativeBanner_1, id 31794086) between the article and the footer, and a Social Bar (ad unit SocialBar_1, id 31794087) as a fixed overlay near the bottom of the viewport. Both loaders come from bicea.org, the Adsterra delivery host for this publisher account. The Native Banner request reports back to bicea.org and draws its creative thumbnails from static.nresystems.com and cdn.storageimagedisplay.com. The Social Bar fetches its notification content from cdn.show-sb.com or cdn.show-creative1.com and its stylesheet, script and images from cdn.holdbitter.com, and the notification document itself pulls the Roboto webfont from fonts.googleapis.com (CSS) and fonts.gstatic.com (font files). Those host names are Adsterra’s rotating content-delivery domains, not site domains, and each request to them discloses your IP address, user agent and the page you came from; Adsterra and Google handle that data under their own policies. Adsterra may open further frames and requests inside those hosts; the ad slot is clipped locally to the viewport width so the widget cannot widen the page, and the page reserves bottom padding while the overlay is active.

Storage we set

First party. The localStorage key mh_consent holds choice (granted or denied) and ts (a timestamp) and is treated as fresh for less than 180 days. After that it is ignored for permission but not deleted automatically, so the default state applies again. If localStorage is unavailable the current page keeps the choice in memory only. The controller sets no first-party cookie of its own.

Google Analytics 4, after acceptance. Cookies _ga (client id) and _ga_FFHXV3E0RP (session state) were measured with roughly 400-day expiry on this implementation; Google documents a default of up to two years for _ga. Requests go to www.google-analytics.com and region endpoints under *.google-analytics.com and *.analytics.google.com.

Microsoft Clarity, after acceptance. Cookies _clck (about one year) and _clsk (about one day) are set on the site domain, and Clarity also sets CLID (about one year), MUID (about 13 months) and short-lived session identifiers such as SM and MR on its own domains. Clarity also attempts a Microsoft advertising identifier sync to c.bing.com; this site’s Content-Security-Policy does not allow that host, so the browser refuses the request.

Adsterra, after acceptance. Its delivery host bicea.org sets short-lived cookies named pip_ followed by a 32-character hex id (one day or session length) plus the Cloudflare bot-management cookie __cf_bm (30 minutes). Creative delivery from static.nresystems.com sets uid_id2 (about 13 months) and ak / acl (about 90 days). The responses checked on 18 October 2026 from cdn.storageimagedisplay.com, cdn.show-sb.com, cdn.show-creative1.com and cdn.holdbitter.com carried no Set-Cookie header; those hosts are reached with the browser’s request for the creative or notification file alone. Those cookies are set by Adsterra’s hosts, not by this site, and their lifetime is controlled by Adsterra.

Legal basis. The optional services above rely on your consent, which you can withdraw at any time with Cookie settings in the footer; the withdrawal applies from that moment and the stored decision keeps them off. Serving the page itself and answering mail are handled by Cloudflare and the mail provider as described below.

YouTube requires acceptance and a play request

A fresh granted choice plus a play request is required before the controller creates a player at www.youtube-nocookie.com. A play request with no choice, an expired choice or a denied choice only opens the panel and remembers a pending video. Accept can then load that requested video; Accept alone does not load every player.

Loading a player connects your browser to Google/YouTube. The player may request media from googlevideo.com and subdomains, and images or player resources from ytimg.com and subdomains, alongside YouTube domains. These are possible player-service domains, not third-party resources preloaded by the local placeholder. Requests can disclose an IP address, browser information and playback activity. Privacy-enhanced mode is not a promise of no processing or storage; Google’s policy governs its handling.

Footer Cookie settings reopens the panel. Choosing Reject clears the pending request, removes loaded YouTube iframes and the advertising scripts on the current page and restores their placeholders. It cannot undo data already sent to Google or Adsterra, or erase their cookies. GPC/DNT refusal takes precedence over a saved grant.

Advertising choices and opt-outs

The ad units this site runs are display widgets: a Native Banner inside the article area and a Social Bar overlay. The site itself does not create pop-under windows. Adsterra decides which creative appears and may use its own cookies (listed above) to select or limit ads; how it does that is described in the Adsterra privacy policy.

You can limit interest-based advertising without visiting this site: the Digital Advertising Alliance opt-out at optout.aboutads.info and, in Europe, youronlinechoices.com. Blocking or deleting the Adsterra cookies listed above also limits repetition and profiling, at the cost of seeing less relevant ads. Rejecting consent here stops the ad requests entirely.

This site declares no ads.txt sellers. Adsterra states in its own publisher help centre that it does not supply ads.txt data, and the publisher dashboard exposes website and ad-unit ids only, no seller id. An invented line would authorise the wrong seller over this inventory, so the file documents the absence instead of guessing.

Hosting and deployment checks

Cloudflare does inject a Web Analytics beacon into the served HTML: the live page on 18 October 2026 carried static.cloudflareinsights.com/beacon.min.js, which is not in this repository. The Content-Security-Policy on this site does not allow that host, so a browser refuses to load it and it collects nothing on your page; the CSP header is the part this repository controls, the injection is not. If Cloudflare Web Analytics is switched off in the dashboard the attempt disappears as well.

Cloudflare still handles request logs and bot management at the edge, and bicea.org sets the Cloudflare bot-management cookie __cf_bm when an ad script is fetched. Hosting providers may process request information to deliver and secure the site.

The script and storage inventory above was read from the consent-gated page in a browser session on 18 October 2026, not only from vendor documentation. Cookie names on a shared third-party domain can change without notice; the domains and the consent gate are the parts this site controls.

Rights and changes

Send privacy questions or requests about correspondence to [email protected]. Include only the information needed to identify the request. Applicable rights and provider retention depend on the service and jurisdiction; this page does not promise a deletion deadline or a retention period for the operator’s mailbox.

The policy date records the reviewed implementation. Deployment-specific service configuration, the operator’s full identity and mail/log retention arrangements still need a documented production review. The confirmed mail-routing configuration is separate from those remaining policy details.

Questions

Do you use Google Analytics, Clarity or an advertising network?

Yes, all three, and only after you accept. Google Analytics 4 uses G-FFHXV3E0RP under consent mode defaults that deny storage; Microsoft Clarity (yzj4kbhlzv) records sessions; Adsterra serves a Native Banner and a Social Bar. Their loaders are created by JavaScript after Accept, so the initial HTML contains no request to any of them. Reject, or Cookie settings then Reject, removes them from the current page.

What happens if I never touch the consent panel?

Nothing optional loads. Analytics storage stays denied, Clarity is never fetched, no ad request is made and no video player is created, because each of those is gated on a stored granted choice rather than on the absence of a rejection.

Can I turn the ads off without leaving the site?

Yes. Open Cookie settings in the footer and choose Reject. The advertising scripts and the ad slot are removed on that page and the stored decision keeps them off for 180 days; choosing Accept again later reloads them.

Sources